CVE-2020-27978

CVE-2020-27978 (Shibboleth Identify Provider 3.x prior to 3.4.6) is a denial-of-service vulnerability where a remote unauthenticated attacker can trigger a login flow that exhausts Java heap by creating objects in the Java Servlet container session. Affected product is Shibboleth Identify Provide...

shibboleth.simplyvoting.com Open Redirect vulnerability OBB-1356587

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

shibboleth-sp.prod.proquest.com Open Redirect vulnerability OBB-1355573

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Security Bulletin: Man in the middle vulnerability CVE-2014-3603 affects Websphere Liberty and OpenLiberty used by MobileFirst Platform Foundation

Summary IBM MobileFirst Platform Foundation has addressed the following vulnerability.Man in the middle vulnerability CVE-2014-3603 affects Websphere Liberty and OpenLiberty Vulnerability Details CVEID: CVE-2014-3603 DESCRIPTION: Shibboleth Identity Provider IdP and OpenSAML Java could allow a...

Security Bulletin: Vulnerabilities in Websphere Liberty and OpenLiberty

Summary There are vulnerabilities in Websphere Liberty used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2014-3603 DESCRIPTION: The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and...

Security Bulletin: Rational Asset Analyzer (RAA) is affected by a WAS vulnerability.

Summary Rational Asset Analyzer RAA has addressed the following vulnerability in WAS. Vulnerability Details CVEID: CVE-2014-3603 DESCRIPTION: The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and OpenSAML Java 2.6.2 do not verify that...

SUSE SLES12 Security Update : shibboleth-sp (SUSE-SU-2020:0115-1)

This update for shibboleth-sp fixes the following issues : Security issue fixed : CVE-2019-19191: Fixed escalation to root by fixing ownership of log files bsc1157471. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenabl...

SUSE-SU-2020:0115-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issues: Security issue fixed: - CVE-2019-19191: Fixed escalation to root by fixing ownership of log files bsc1157471...

openSUSE Security Update : shibboleth-sp (openSUSE-2020-20)

This update for shibboleth-sp fixes the following issues : Security issue fixed : - CVE-2019-19191: Fixed escalation to root by fixing ownership of log files bsc1157471. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and...

openSUSE: Security Advisory for shibboleth-sp (openSUSE-SU-2020:0020-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0020-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issues: Security issue fixed: - CVE-2019-19191: Fixed escalation to root by fixing ownership of log files bsc1157471. This update was imported from the SUSE:SLE-15:Update update project...

Security update for shibboleth-sp (moderate)

openSUSE Security Update: Security update for shibboleth-sp Announcement ID: openSUSE-SU-2020:0020-1 Rating: moderate References: 1157471 Cross-References: CVE-2019-19191 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for...

SUSE SLES15 Security Update : shibboleth-sp (SUSE-SU-2019:3386-1)

This update for shibboleth-sp fixes the following issues : Security issue fixed : CVE-2019-19191: Fixed escalation to root by fixing ownership of log files bsc1157471. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenabl...

SUSE-SU-2019:3386-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issues: Security issue fixed: - CVE-2019-19191: Fixed escalation to root by fixing ownership of log files bsc1157471...

Shibboleth Service Provider Elevation of Privilege Vulnerability

Shibboleth is an open source SAML-based Web Single Sign-On system for Windows platforms from Shibboleth, U.K. The Service Provider SP is one of the service provider components, which is mainly used to intercept access to protected resources or application entry points, issue SAML authentication...

CVE-2019-19191

Shibboleth Service Provider SP 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user the shibd account after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow...

DEBIAN-CVE-2019-19191

Shibboleth Service Provider SP 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user the shibd account after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow...

CVE-2019-19191

Shibboleth Service Provider SP 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user the shibd account after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow...

Code injection

Shibboleth Service Provider SP 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user the shibd account after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow...

CVE-2019-19191

Shibboleth Service Provider SP 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user the shibd account after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow...